Video yükleniyor...

Video Yüklenemedi

Ana Sayfaya Dön

WMI Lateral Movement Demonstration: SMB file transfer with Win32_Process execution #ThreatHunting #DFIR

ACEResponder's profile picture

ACE Responder

17,824 subscribers

28,992 görüntüleme • 3 yıl önce •via X (Twitter)

#ThreatHunting#DFIR
LIVE

Anya Rossi• Live Now

Private livecam show

0 Yorum

Yorum bulunmuyor

Orijinal gönderinin yorumları burada görünecek

Benzer Videolar

Remote execution with scheduled tasks demonstration. #DFIR #ThreatHunting
0:40

Remote execution with scheduled tasks demonstration. #DFIR #ThreatHunting

ACE Responder

25,033 görüntüleme • 2 yıl önce

How PsExec lateral movement works. #ThreatHunting #DFIR
0:37

How PsExec lateral movement works. #ThreatHunting #DFIR

ACE Responder

27,763 görüntüleme • 2 yıl önce

Detecting Remote Service Lateral Movement (formerly PsExec) #ThreatHunting #DFIR
5:23

Detecting Remote Service Lateral Movement (formerly PsExec) #ThreatHunting #DFIR

ACE Responder

21,063 görüntüleme • 1 yıl önce

An example of DCOM lateral movement - MMC20.Application with a mshta payload #ThreatHunting #DFIR
0:46

An example of DCOM lateral movement - MMC20.Application with a mshta payload #ThreatHunting #DFIR

ACE Responder

24,980 görüntüleme • 3 yıl önce

Today's cold-blooded execution of a citizen of Minneapolis is Trump's response to yesterday’s powerful demonstration against ICE’s reign of terror. It is urgent that workers build a rank-and-file movement for a nationwide general strike!
4:27

Today's cold-blooded execution of a citizen of Minneapolis is Trump's response to yesterday’s powerful demonstration against ICE’s reign of terror. It is urgent that workers build a rank-and-file movement for a nationwide general strike!

David North

18,690 görüntüleme • 5 ay önce

How AS-REP Roasting works. 🔐 This animation demonstrates the more secure Kerberos pre-auth and contrasts it with an AS-REP roasting attack which abuses the 'Do not require Kerberos preauthentication' setting. #ThreatHunting #DFIR
1:07

How AS-REP Roasting works. 🔐 This animation demonstrates the more secure Kerberos pre-auth and contrasts it with an AS-REP roasting attack which abuses the 'Do not require Kerberos preauthentication' setting. #ThreatHunting #DFIR

ACE Responder

33,118 görüntüleme • 2 yıl önce

When your hips and shoulders rotate simultaneously at takeaway, it creates excessive lateral movement and poor weight transfer. #golf
0:22

When your hips and shoulders rotate simultaneously at takeaway, it creates excessive lateral movement and poor weight transfer. #golf

Kerrod Gray | Professional Golf Coach

210,403 görüntüleme • 1 yıl önce

Making movement easier with Frido Patient Transfer Lift. Designed and Made in 🇮🇳
0:25

Making movement easier with Frido Patient Transfer Lift. Designed and Made in 🇮🇳

Ganesh Sonawane

1,127,221 görüntüleme • 4 ay önce

Cowork is now available on Windows. We’re bringing full feature parity with MacOS: file access, multi-step task execution, plugins, and MCP connectors.
0:30

Cowork is now available on Windows. We’re bringing full feature parity with MacOS: file access, multi-step task execution, plugins, and MCP connectors.

Claude

2,791,196 görüntüleme • 5 ay önce

"I am hitting him with lateral movement" is some of the craziest trash talk ever 😂 Hakeem Olajuwon was always calculated with his 'sophisticated s**t talk'.
1:09

"I am hitting him with lateral movement" is some of the craziest trash talk ever 😂 Hakeem Olajuwon was always calculated with his 'sophisticated s**t talk'.

KG: Certified

204,213 görüntüleme • 8 ay önce

Getting better in handling relighting, motion transfer and lip movement transfer. Test done with a custom wan workflow + various loras I guess you can now act from anywhere
0:33

Getting better in handling relighting, motion transfer and lip movement transfer. Test done with a custom wan workflow + various loras I guess you can now act from anywhere

Stelfie the Time Traveller

40,148 görüntüleme • 8 ay önce

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat
3:20

🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat

Clandestine

40,619 görüntüleme • 2 ay önce

A file transfer setup using no internet, Bluetooth, or USB drive. The sender converts the file into encoded QR code frames displayed rapidly on screen. The receiver scans those frames continuously with its camera and reconstructs the original file. The camera is the only communication bridge. Works entirely offline particularly relevant for air-gapped systems where network transfer isn't an option.
0:20

A file transfer setup using no internet, Bluetooth, or USB drive. The sender converts the file into encoded QR code frames displayed rapidly on screen. The receiver scans those frames continuously with its camera and reconstructs the original file. The camera is the only communication bridge. Works entirely offline particularly relevant for air-gapped systems where network transfer isn't an option.

Md Ismail Šojal 🕷️

62,596 görüntüleme • 6 gün önce

Neat look from Belal He switches to open stance to cut off JDM's lateral movement with his body kick then steps through to orthodox to close distance and immediately threaten with pressure
0:21

Neat look from Belal He switches to open stance to cut off JDM's lateral movement with his body kick then steps through to orthodox to close distance and immediately threaten with pressure

MixingMartialArts

117,819 görüntüleme • 1 yıl önce

Here’s some drip marketing for the exploit I’m dropping. Full RCE over network play with arbitrary file transfer while you play. Stay tuned, it gets better…
0:27

Here’s some drip marketing for the exploit I’m dropping. Full RCE over network play with arbitrary file transfer while you play. Stay tuned, it gets better…

Ryan M

70,722 görüntüleme • 2 yıl önce

Shakur Stevenson says he’s not a “runner” and people are making narratives based on one performance with Edwin De Los Santos. He explains why he used lateral movement in that fight.
1:33

Shakur Stevenson says he’s not a “runner” and people are making narratives based on one performance with Edwin De Los Santos. He explains why he used lateral movement in that fight.

Naji

26,682 görüntüleme • 5 ay önce

Another cool app built with Perplexity Computer. A peer to peer file(s) transfer web app. Sends files directly with no accounts using WebRTC and DTLS encryption, file chunking, socket io signaling. I am impressed by how many libraries and tools Computer can orchestrate reliably.
0:54

Another cool app built with Perplexity Computer. A peer to peer file(s) transfer web app. Sends files directly with no accounts using WebRTC and DTLS encryption, file chunking, socket io signaling. I am impressed by how many libraries and tools Computer can orchestrate reliably.

Aravind Srinivas

52,596 görüntüleme • 4 ay önce

We are about to start the 30th mass demonstration organised by this unprecedented movement. Our aim to force this government to completely break with the Israeli state. There are no excuses.
0:27

We are about to start the 30th mass demonstration organised by this unprecedented movement. Our aim to force this government to completely break with the Israeli state. There are no excuses.

Chris Nineham

110,194 görüntüleme • 11 ay önce

During the execution of a special mission, Ukrainian SOF group eliminated three occupiers and captured two POWs. SOF operators applied a hard demonstration of force, precise timing, and uncompromising communication with russian troops. The fortification was completely cleared.
1:34

During the execution of a special mission, Ukrainian SOF group eliminated three occupiers and captured two POWs. SOF operators applied a hard demonstration of force, precise timing, and uncompromising communication with russian troops. The fortification was completely cleared.

SPECIAL OPERATIONS FORCES OF UKRAINE

910,428 görüntüleme • 6 ay önce